create(); $other = User::factory()->create(); Recording::query()->create([ 'user_id' => $owner->id, 'title' => 'Mine', 'original_filename' => 'mine.mp3', 'file_path' => 'recordings/mine.mp3', 'file_size_bytes' => 10, 'transcription_status' => 'done', ]); Recording::query()->create([ 'user_id' => $other->id, 'title' => 'Theirs', 'original_filename' => 'theirs.mp3', 'file_path' => 'recordings/theirs.mp3', 'file_size_bytes' => 10, 'transcription_status' => 'done', ]); $this->actingAs($owner) ->get(route('recordings.index')) ->assertOk() ->assertSee('Mine') ->assertDontSee('Theirs'); } public function test_user_cannot_view_another_users_recording(): void { $owner = User::factory()->create(); $intruder = User::factory()->create(); $recording = Recording::query()->create([ 'user_id' => $owner->id, 'title' => 'Private', 'original_filename' => 'private.mp3', 'file_path' => 'recordings/private.mp3', 'file_size_bytes' => 10, 'transcription_status' => 'done', ]); $this->actingAs($intruder) ->get(route('recordings.show', $recording)) ->assertForbidden(); } public function test_user_cannot_delete_another_users_recording(): void { $owner = User::factory()->create(); $intruder = User::factory()->create(); $recording = Recording::query()->create([ 'user_id' => $owner->id, 'title' => 'Keep me', 'original_filename' => 'keep.mp3', 'file_path' => 'recordings/keep.mp3', 'file_size_bytes' => 10, 'transcription_status' => 'done', ]); $this->actingAs($intruder); Livewire::test(Show::class, ['recording' => $recording]) ->assertForbidden(); $this->assertDatabaseHas('recordings', ['id' => $recording->id]); } }